Privacy Policy

As of 07/05/2026

1. Introduction and Scope

This Privacy Policy describes how we process personal data when you visit the website suedtirolwellness.com or use the functions offered there. Personal data is any information relating to an identified or identifiable natural person (e.g. name, email address, IP address).

We process your data in accordance with the General Data Protection Regulation (GDPR), the applicable Italian data protection regulations and other relevant provisions. The following information explains the nature, scope, purposes, legal bases, storage periods and your rights.

2. Controller

Online Media
Gerbergasse 22/A, 39100 Bolzano (BZ), Italy
Phone: +39 327 853 6826
PEC: kousminscki.armin@pec.it
VAT: IT03199310214 · REA: BZ-240361 · CF: KSMRMN93L25A952E.
The data is taken from the commercial register extract.

3. Data Processing When Visiting the Website (Server Logs)

When you access our pages, data is automatically processed by the web server: IP address, date and time, requested URL, referrer URL, browser and operating system used, HTTP status code. Purpose: operation, security of the infrastructure, error analysis. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest). Storage period: usually 7 to 14 days; in case of security-related events, beyond that until final clarification.

4. Consent Management (Cookies/Tracking)

We use a Consent Management Platform (CMP) that stores and controls your choices regarding cookies/similar technologies. Non-essential cookies and comparable technologies are only activated after your express consent. You can change or withdraw your consent at any time via the CMP settings with effect for the future. Legal bases: Art. 6 (1) (c) GDPR (compliance with legal obligations under ePrivacy provisions, proof of consent) and Art. 6 (1) (f) GDPR (documentation/evidence purposes).

5. Reach Measurement with Google Analytics 4

We use Google Analytics 4 (GA4) by Google Ireland Limited for statistical analysis of website usage. We have enabled IP anonymization. Processing only takes place if you have consented via the CMP. GA4 may transfer data to third countries (in particular the USA) as part of the service. Google LLC is certified under the EU-US Data Privacy Framework; in addition, Standard Contractual Clauses and technical/organisational measures may be used. Purpose: statistics/performance analysis, improvement of our offering. Legal basis: Art. 6 (1) (a) GDPR (consent). Storage period at Google Analytics: e.g. 14 months (unless configured differently in the account). You can withdraw your consent at any time via the CMP. Alternatively, deactivation via browser add-ons is possible.

6. Marketing with Meta Pixel (Facebook/Instagram)

If you consent via the CMP, we use the Meta Pixel by Meta Platforms Ireland Ltd. to measure visitor actions and display interest-based ads on Facebook/Instagram (remarketing/conversion measurement). In doing so, pseudonymous usage data may be processed and transferred to the USA (EU-US DPF/SCC). Purpose: marketing/remarketing, campaign control. Legal basis: Art. 6 (1) (a) GDPR (consent). You can withdraw your consent at any time via the CMP.

7. Embedded Content: Google Maps

On hotel detail pages we embed Google Maps so that you can see locations. For data protection reasons, we use a 2-click solution: a connection to Google is only established when you actively load the map. Google may then process usage data (including IP address); a third-country transfer may occur (EU-US DPF/SCC). Legal basis: Art. 6 (1) (a) GDPR (consent after click). If you do not consent, the map will not be loaded.

8. Contact and Inquiry Forms (Forwarding to Hotels)

Through our forms you can send inquiries directly to a selected hotel. Data processed: first and last name, email address, number of adults/children, planned check-in/check-out, free-text message. Purpose: processing of your inquiry and forwarding to the hotel you have selected; the hotel then processes your data under its own responsibility. Legal basis: Art. 6 (1) (b) GDPR (pre-contractual measures upon your request). Storage at our end: We do not permanently store the contents of the inquiry on the web server. If protocol data/backups arise for technical reasons, they will only be used to ensure delivery and for IT security and will be deleted after an appropriate period. Please note: The respective hotel is an independent controller and can provide you with further information on data processing.

9. Recipients and Processors

We use AWS for hosting/operating the website and Mailchimp for email delivery, who act on our behalf (Art. 28 GDPR). Data processing agreements are in place with these providers. In addition, Google (Analytics) and Meta (Pixel) receive data if you have consented. Insofar as data is processed outside the EEA, this is done on the basis of an adequacy decision (EU-US DPF) or suitable safeguards, in particular Standard Contractual Clauses, each accompanied by additional protective measures.

10. Storage Period

We process personal data only for as long as is necessary for the respective purposes. Statutory retention periods (e.g. commercial/tax law periods) and limitation periods for asserting or defending claims apply. After that, data is deleted or anonymized.

11. Your Rights

Within the legal framework, you have the right to information, correction, deletion, restriction of processing, data portability and the right to object to processing based on Art. 6 (1) (f) GDPR. Consent given can be revoked at any time with effect for the future (e.g. via the CMP).

12. Data Security

We protect your data through TLS encryption, role-based access, logging, backups and organizational measures pursuant to Art. 32 GDPR to ensure a level of protection appropriate to the risk.

13. Changes to this Policy

We adapt this policy when technical processes, services or legal situations change. The current version published on the website always applies.